If you run the Security Optimizer plugin and have IP-based login restrictions enabled, treat that control as bypassed until you patch. The vulnerability (CVE-2026-13342) affects versions 1.5.8 through 1.6.4, and allows attackers to circumvent IP-based access restrictions—meaning anyone the restriction was meant to block can still reach the login page as if the control didn't exist.
The practical impact is worse than it initially appears. An IP restriction that fails silently gives administrators false confidence. You configure it, the admin panel shows it as active, you make security decisions based on that enabled state—and the protection isn't there. An attacker targeting a site with this feature enabled has an advantage over targeting a site with no IP restriction at all, because you've demonstrated you thought about access control and made a deliberate configuration choice that the attacker can now subvert.
Immediate steps: disable the IP restriction feature in Security Optimizer if you're running a vulnerable version, or upgrade to 1.6.5 or later once available. Do not rely on IP-based access controls in WordPress plugins as a primary defense layer—these controls are notoriously difficult to implement correctly due to how HTTP proxies, CDNs, and reverse proxies handle client IP addresses. The bypass typically stems from the plugin failing to correctly resolve the actual client IP versus headers that can be spoofed or misconfigured.
The broader lesson is that optional security features in security-focused plugins receive less development scrutiny than core functionality, yet administrators trust them as if they carried the same rigor. When evaluating security plugins, treat optional access controls as lower-confidence than the primary authentication mechanisms.